1

I am using dpkt library to get timestamp of packets and need to convert it into seconds. Below is my code to get packet timestamp:

f = open('test.pcap')
pcap = dpkt.pcap.Reader(f)
for ts, buf in pcap:
      print "timestamp:",ts

I have 2 questions here:
1. Is the timestamp in milliseconds as I am not able to confirm this from documentation?
2. If it is in milliseconds... good way to convert to seconds is ts/1000.0 ?

ojas
  • 2,150
  • 5
  • 22
  • 37

1 Answers1

1

Look, seconds, milliseconds and nanoseconds are units of time duration. Right? While, A timestamp is the instant of time at which a packet is sent or received. Usually, in Wireshark, the time stamp consists of the date (in days since 1.1.1970) and the time of day (in nanoseconds since midnight).

Now after clarifying the difference, the following one-line code (using dpkt tool and python) can convert a 

print ('Timestamp: ', str(datetime.datetime.utcfromtimestamp(ts)))

Timestamp: 2019-09-05 08:59:34.269526

Am I clear?

Muhammad Asif Khan
  • 319
  • 4
  • 11
  • Timestamps are *not* just the instant a package is sent or received, it is a broader term, applying to any moment in time (that is not just Packages in Wireshark, timestamps can also be stored in variables in any language, representing a moment in time *something* happened). – DarkCygnus Sep 08 '17 at 18:54
  • Also, could you please clarify what that line of code does? Seems like you missed part of your explanation (convert a...?) or at least I did not get what you mean. Also, welcome to Stack Overflow :) good luck with your coding – DarkCygnus Sep 08 '17 at 18:57
  • @GrauCygnus, you are right, however the question was specific to packet timestamps in pcap files... – Muhammad Asif Khan Sep 08 '17 at 18:57
  • I agree with that, but still could be misleading to give such a limited definition of what Timestamps are – DarkCygnus Sep 08 '17 at 18:58
  • :), okay. the code will work fine. I copied it from my script while I was working on at the moment. – Muhammad Asif Khan Sep 08 '17 at 19:00
  • I am new to StackOverflow. Bear with me :) – Muhammad Asif Khan Sep 08 '17 at 19:02
  • It is ok, everyone was new here at some point. Sorry if my comments seem snappy or rude, I was just trying to help you improve based on some constructive feedback (most other users will just Down vote you or flag without bothering) . – DarkCygnus Sep 08 '17 at 19:04